Protection of appointment systems

Appointments with public administrations are a limited resource that are released only during specific time slots. Operators using automated systems snap them up in seconds and resell them, while citizens typically encounter the message “no appointments available.”

Malicious traffic uses residential and mobile proxies, CAPTCHA solver farms, and full client-side automation. Containing it requires combining network, client, and behavioral signals.

Read our blog post

Use case

The vulnerability

Attackers study the booking flow, locate its weak points, and traverse it with automatically controlled browsers, randomized browsing times, user agents, simulation of general human behavior, automation extensions, and AI-generated engines.

Impact:

The slots fill up in seconds every time they release a batch of appointments.
Citizens cannot find appointments and resort to intermediaries who resell them.

How they do it:

The identifiers are generated using publicly available algorithms, without real data.
The CAPTCHA is solved by human solver farms or AI and OCR models.
The traffic arrives via local residential and mobile IPs, difficult to distinguish from normal traffic.
Its geolocation sometimes contradicts the declared origin.
The volume is distributed across thousands of IPs with very few requests each.
Headers, cookies, parameters, JavaScript, and the client fingerprint are falsified. Query bots locate gaps, and a second process populates the form with stored data.

Transparent Edge’s response

Transparent Edge engineers analyzed the client’s actual traffic and configured a layered filtering system that separated valid traffic from invalid traffic. The configuration was fine-tuned in collaboration with the client, including reviewing for false positives and expanding the rules for each automation variant.

Deployment of protection strategy

Analysis of the reservation flow and existing traffic to identify abuse points.
Place the service behind the CDN so that filtering is applied before reaching the origin.
Origin layer: IP reputation and geolocation consistency.
Identity layer: Cookies, user-agent, and client fingerprint.
Execution layer: JavaScript verification with risk-based challenges.
Behavior layer: Bot management of client interaction.
Navigation layer: Screen sequence validation.
Integrity layer: WAF against manipulated requests.
Volume control with Under Attack Mode during peak times.
Continuous rule tuning alongside the client.

Our actions produce results

Legitimate users regain access to appointments when they are published, without any additional visible steps. The protection combines several signals. Each layer discards a portion of invalid traffic, and the client and behavioral layers cover what CAPTCHA and IP address detection miss.

Recommendations for appointment booking sites

Si gestionas un servicio con un recurso escaso y ventanas de liberación, revisa estos puntos:

– Analyze the client and their behavior, in addition to the IP address.

– Combine multiple layers of verification.

– Protect the entire process: query, form, and confirmation.

– Review the rules regularly, because attackers change their methods.

What can Transparent Edge do?

We’ll support you with our team’s expertise to implement restrictions and adjustments tailored to your business. We combine layers of security, detection, and mitigation across the entire web service journey. Control your environment and protect your website’s surface.

Talk to an expert

Do you want to know the full story of how Transparent Edge was able to stop bots that were taking appointments away from citizens?

Read the full story